Automatic Signed Exchanges: One-Click SXG Support for Google Search

Cloudflare has announced that all Pro, Business, and Enterprise customers can now generate Signed Exchanges (SXG) for Google Search with a single toggle. SXG is an open web platform specification from Google that authenticates the origin of a cached resource. This lets third-party delivery services — Google's own search page, or a news aggregator linking out — serve a verified copy of your site.

The implications are twofold: sites linked from SXG-supporting platforms load noticeably faster, and because page speed is a known search-ranking factor, site owners typically see a corresponding lift in SEO.

How SXG works

SXG is a delivery mechanism that cryptographically binds a resource to its origin regardless of the delivery path. That separation of origin and delivery channel enables secure caching, prefetching, and serving from third-party infrastructure without leaking user signals back to the origin server.

The flow for a search-engine use case looks like this: When a crawler arrives at your site, it signals a preference for signed exchanges via an Accept: application/signed-exchange;v= request header. Cloudflare then generates the SXG as follows:

  1. Cloudflare fetches the original content and its response headers.
  2. A Digest header is added, using Merkle Integrity Content Encoding for progressive tamper detection.
  3. Transport-level headers (e.g., Connection, Keep-Alive) and security-sensitive ones (e.g., Set-Cookie) are stripped.
  4. The headers, digest, request URL, certificate URL and hash, expiration time, and other metadata are consolidated and signed.
  5. The final binary — headers, signature, and a fallback URL — is packaged for delivery.

Once the crawler stores the exchange, the search engine can index it, then prefetch the signed exchange into a user's browser before the click. Because the browser validates the exchange against the site's certificate, it renders the content with full attribution to the original URL. The user sees an instantaneous page load from local cache, and the search intent stays with the search engine (no signal is sent to the origin ahead of the click).

The signing process is the part that isn't trivial. Correct SXG implementation requires several infrastructure pieces:

  • A certificate carrying the CanSignHttpExchanges extension.
  • Delivery of certificates in CBOR (binary JSON) format.
  • OCSP stapling to validate the certificate in real time.
  • Frequent certificate renewal, typically automated.
  • Caching of generated exchanges, since the signing step is expensive to repeat.

Cloudflare's existing certificate lifecycle management and TLS infrastructure already covers the bulk of that machinery, so the feature is a switch rather than a build-your-own project.

"Signed Exchanges make the web faster and a better user experience for users, by enabling cross-site prefetching. Site owners have seen clear improvement to Largest Contentful Paint, one of the Core Web Vitals, as well as increased user stickiness." — Jeff Jose, Product Manager, Google

Portable content beyond search

The broader promise of SXG is content portability. Historically, distributing your content through a third party while preserving attribution meant handing that party your SSL private keys — a security liability and a weak foundation for real portability.

SXG separates the signing from the serving, so any distributor can carry your content without your certificate. In the near term, the practical outcome is faster delivery from Google Search, which caches and frequently prefetches SXGs. Sites with meaningful Google-referred traffic stand to gain the most immediately.

The longer-term outlook: if the standard becomes universal, browsers could prefetch every linked article on a page. Page-load speeds across the entire web would shift upward as a result.

Getting started

Automatic Signed Exchanges is available at no additional cost to Cloudflare Pro, Business, Enterprise customers, and users of the Advanced Platform Optimization product for WordPress.

Activation is a two-stage process. From the Speed page in the Cloudflare dashboard, customers add themselves to the Beta waitlist via the "Automatic Signed Exchanges (SXGs)" card. After approval, it's a single switch to turn on.